How to map public static IP addresses to Hidden Services?

Question

we want to configure a TOR router to route public static IP addresses to hidden services.

Currently we have the following setup working:

VirtualAddrNetworkIPv4 10.192.0.0/10
VirtualAddrNetworkIPv6 [FC00::]/7
AutomapHostsOnResolve 1
TransPort 127.0.0.1:9040
TransPort     [::1]:9040
DNSPort   127.0.0.1:5300
DNSPort       [::1]:5300

iptables  -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040
ip6tables -t nat -A OUTPUT -p tcp -d FC00::/7      -j REDIRECT --to-ports 9040

My first idea was to use the public static IP-networks with the PREROUTING chain. Updating the IP-addresses every 60 seconds is a no-go as DNSSEC will be used to validate the DNS A/AAAA-record lookups. We also need additional DNS-records (e.g. MX-RRs) which won't work with the TOR resolver.

I already tried

MapAddress <hidden service>.onion 10.192.0.4

which results in a correct A-RR when VirtualAddrNetworkIPv4 is uncommented. But TOR doesn't route the packets.

Thanx for any hint,

Renne

Answer 1

This is a pretty simple task, just to answer the question, here is how you'd do it....

But before you read how, repeat after me:

"I should never actually do this!"

Hypothetically, if this was ever actually useful, which it isn't, and assuming your onion is foo.onion and your public IP is 1.2.3.4

torrc like this:

TransPort 1.2.3.4:9040 # 
SocksPort 0 # we dont need this
MapAddress 1.2.3.4 foo.onion # connections for our public IP are mapped to the onion

Then we use iptables to set some incoming traffic for whatever our chosen port is, say 80, to redirect to the TransPort, for example:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9040

Port 80 on our public IP would be passed into TransProxy, the destination IP 1.2.3.4 in TransProxy would be mapped to foo.onion and the communications passed on to foo.onion and the response send back to whomever was connecting to 1.2.3.4.

Update:

The TransPort can be set once for many ports, the original destination and port are recovered after the -j REDIRECT rule through use of getsockopt() calls (see SO_ORIGINAL_DST), so many destination ports and IPs can map to a single TransPort instantiation.

And my issue is that while the server is protected, the users are not receiving any protection from Tor. It constitutes the "SSL Added And Removed Here :¬)" security anti-pattern, as seen in tor2web and similar projects.

---

P.S. Yes, I am aware I'm a terrible human being for actually answering this query but sometimes you gotta let them shoot themselves in the foot after failing to heed all warnings.